02 · AGENT
Available todayAgents call the same actions. Safely.
AI agents and backend automations call the same manifest-gated actions — partner integrations via scoped profiles, internal jobs via shell tokens. Not scraping, not guessing, not blanket API access.
See it in action
An agent invokes a manifest-gated action.
A structured call over the same actions your users see — permission-checked before anything reaches your API. Partner agents use scoped profiles; your backend uses a shell token.
User’s Agent
AI assistant
Waiting to run…
Gate ready · rules loaded
Listening for invoke…
No request received
Nothing has reached your API yet.
Request sent
refund orderHeld by Duct
Needs approvalUser approves
in your appApproved
Permission grantedExecuted
One-time passRefunded
logged for auditWhy this mode
One Shelli. Three callers.
Same contract as humans
Agents invoke the same actions your users see in chat. One manifest, one permission layer — no separate agent stack to maintain.
Two auth paths
Partner and external agents use named profiles (shell_id + profile slug, no root secret). Your own backend uses a shell token from your server — same invoke API, different credential.
Consent without a UI
Side effects pause with a structured confirmation step and a short-lived token. The agent retries once approved — the API equivalent of the human confirmation card.
Flow
How it works
Define actions once in duct.config.ts — this is how that contract plays out for this caller.
Caller authenticates
Company backends exchange DUCT_SECRET_KEY for a shell token (st_). Partner agents exchange shell_id + profile for an agent token (at_) — no root secret leaves your control.
Agent calls an action
Invoke a declared action with typed params — structured and permission-checked against your manifest.
Side effects pause
Irreversible actions return a confirmation step. The agent confirms, then retries — same gate as chat.
Audit row on every call
Who called what, with what consent, with what result. Long-running actions support async delivery.